Download PDF - Codenomicon

CODENOMICON WHITEPAPER - Proactive Cyber Security: Stay Ahead of Advanced Persistent Threats (APTs)
Combining Internal and External Information
Comprehensive situation awareness is achieved by combining threat and vulnerability intelligence from internal
and external sources. Most organizations employ SIEM systems and IPS/IDS solutions, which provide
valuable insight into incidents within networks. However, even serious cyber threats can be dismissed as
random attacks, if the security personnel lack the global abuse situation awareness needed to examine events
in coordination with other security incidents.
Similarly, external abuse information requires
network-specific intelligence to be applied into
practice. Figure 10 depicts the iteration of abuse
situation awareness from internal and external
sources. The internal resources include vulnerability
and threat information from internal threat
monitoring and in-house fuzz tests. The external
resources include general abuse feeds and
industry-specific threat information. Utilizing
external information sources used to be challenging,
due to the lack of common information
sharing standards. AbuseSA solves this problem
by being format-independent. You can use AbuseSA collect and present information in any format making
it easier to combine internal and external security intelligence. The AbuseSA also makes it possible to share
security information within industries on a completely new level.
13
Conclusion
Cyber attacks are getting more sophisticated and traditional signature-based defenses are no longer enough
to secure increasingly public networks. There has been a sharp rise in Advanced Persistent Threats, highlymotivated
and well-resourced groups carrying out high-impact attacks. These attacks frequently exploit zeroday
vulnerabilities making them hard to detect and difficult to defend against.
This paper presented two approaches to handling such threats. Firstly, fuzzing can be used to prevent zeroday
attacks by getting rid of exploitable vulnerabilities proactively. Secondly, abuse situation awareness provides
you with the information you need to respond to cyber attacks rapidly.
The best results can be achieved by incorporating fuzzing and situation awareness best practices in to your
organizations processes. Fuzzing should be a part of your software development and procurement processes.
Similarly, abuse situation awareness should be a part of your network monitoring processes automating the
collection of abuse and incident information from internal and external sources. Due to the complexity and
vastness of critical networks, the only effective form of cyber security is proactive cyber security.